DTP Attack.

An attack that abuses Cisco Dynamic Trunking Protocol on an access port to negotiate a trunk with the switch and gain access to multiple VLANs. It belongs to the Attacks & Threats category of cybersecurity.

An attack that abuses Cisco Dynamic Trunking Protocol on an access port to negotiate a trunk with the switch and gain access to multiple VLANs.

DTP (Dynamic Trunking Protocol) is a Cisco-proprietary protocol that lets two switches automatically negotiate whether a link should become an 802.1Q trunk. Many access ports are left in the default dynamic auto or dynamic desirable mode, so an attacker can send DTP frames from a host (Yersinia, scapy) and convince the switch to form a trunk to the attacker. Once trunked, the attacker can tag frames into any allowed VLAN and reach segments that should be isolated, often used as the entry vector for switch-spoofing VLAN hopping. Defenses: configure all user-facing ports as 'switchport mode access' and 'switchport nonegotiate', limit allowed VLANs on trunks, and disable DTP globally on modern designs.

Defences for DTP Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Dynamic Trunking Protocol abuse, Trunk negotiation attack.